lightpanda-io/browser 1.0.1 on GitHub

Behavior changes

setImmediate and clearImmediate were removed (deprecated, not part of the web platform).
MCP and agent modes now load external stylesheets by default.
Max HTTP redirects raised from 10 to 20, matching the Fetch spec.
Unsupported protocols are no longer navigated to; javascript: URLs are run instead of navigated to.

Web Locks
Compression Streams API
RSA-OAEP in Web Crypto (generateKey, importKey, encrypt, decrypt)
Custom elements: ElementInternals and form-associated callbacks
Request.body and Request.textStream
HTMLFormElement.reset, form numeric and named index, form.field
HTMLTableElement.rows, HTMLSelectElement.remove(index), select.length setter
textarea.type, fieldset.type, output.type; HTMLMeterElement accessors
GlobalEventHandlers attributes on Window and Document; document named index
Performance secondary buffer; performance.timeOrigin relative to the Unix epoch
Console and CSS are now proper namespaces; more missing namespace methods

Implicit submit on Enter; improved form submission; GET submissions replace the action's query
Fire change when typed text is committed by blur or Enter
Ctrl+A selects the whole value in text fields
All text edits go through one gated path; better contenteditable detection
Single-contact touch for CDP, testdriver and BiDi
One WebDriver key table shared by BiDi, testdriver and press
Click press/release sequences shared across input paths and matched to Chrome
Keydown default actions run only for trusted events
Range and color inputs get their default value; input.value reflects to the attribute in default modes
Skip inputs with an empty name; :checked applies to options; option text strips and collapses whitespace

fetch resolves after headers are received; an abort signal aborts a fetch
XHR response header compliance; improved data-URL parsing
Exceptions from timers, animation frames, on* handlers, observers and microtasks go to reportError
on* handler attributes behave like any other event listener
document.open resets loaded frame state; several document.close crash fixes
Fire popstate on a fragment navigation; history traverses within a document by entry
Each Window gets its own History; Location URLs resolve against the calling document
Dynamic <base> updates the document base URL
iframe reflects and reacts to src; sandbox token queries; iframe removal cleanup
replaceChildren adopts nodes from another document
Classic scripts are decoded with their charset
Timers accept any value; negative delays clamp to zero
IntersectionObserver only intersects connected targets
Fix custom element upgrade ordering during fragment parsing; undefined custom elements use the HTMLElement prototype

Computed style reports initial values and a resolved font-size; padding, margin and border widths default to 0px
text-transform applied in innerText and resolved in getComputedStyle
revert and revert-layer treated like inherit
Decode fetched stylesheets; fix tokenizer exponent and hyphen-escape bugs; external stylesheet cap raised to 4 MiB
Hit testing honors pointer-events:none and visibility:hidden
Visibility inheritance matches Chromium in styles and the AX tree
Hide a [popover] that is not showing
Block-level flex and grid containers no longer grow with their items
Selectors: :valid/:invalid on every validity constraint, :read-write/:read-only per HTML, case-insensitive attribute values, type selectors on XML and foreign elements, pseudo-elements accepted

Pause requests at the Fetch response stage
Start of the Debugger domain
Emit Runtime.exceptionThrown for uncaught page exceptions
Page.navigatedWithinDocument for fragment navigations and traversals; Target.targetInfoChanged on URL/title change
Honor Page.navigate referrer/referrerPolicy and client target filters in setAutoAttach
Keyboard input reaches the focused element inside an iframe; rawKeyDown dispatches keydown
AX tree: depth param, properties written closer to Chrome, accepted without params
Accept the cookie fields Chrome accepts, so deleteCookie works

Update libcurl to 8.23.0; enable zstd
Check more HTTP caching headers
Cookies: keep a session cookie set with expires -1; accept a UTC zone in expires
--http-curves to set TLS key exchange groups; --http-debug for libcurl verbose output
serve accepts the --advertise-host name as the WebSocket Host

MCP runs each HTTP session on its own thread; idle sessions can be reaped with --http-session-timeout (off by default)
Agent: --trace writes one JSON line per step; --trace-results adds tool result text
Agent: tells the model today's date, flags 4xx/5xx navigations, drops stale tool results
Tree tool: maxBytes budget with [more] markers; iframes listed with their URL
Search drops results the browser would block
Telemetry records tool calls and the MCP client name

PDF output includes the actual text
--render-font adds fonts for characters the bundled DejaVu fonts lack (e.g. CJK)
More aggressive clutter stripping; <template> contents serialized; fenced code blocks keep their language

Return freed malloc memory to the OS when a connection closes (glibc)
Cache computed ancestry values and the root node during parse
Faster Node.getDocument, owner frame lookup and anchor query matching
Backtrack limit on user-supplied regex
Limit V8 ArrayBuffer allocation to 4 GB; don't copy ReadableStream chunks into the page arena